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ABSTRACT 


This  paper  will  define  the  concept  of  vital  functions  as  applied 
to  ship  design.  A list  of  vital  functions  is  proposed  and  methods  which 
are  currently  used  to  protect  these  functions  are  listed.  Finally,  a 
short  procedure  is  given  which  can  Identify  vulnerable  parts  of  a func- 
tional area  and  suggest  types  of  protection. 

Naval  Ships  are  designed  with  much  built-in  protection.  The  vital 
functions  concept  is  introduced  here  as  part  of  an  approach  which  will 
help  to  make  this  protection  consistent  for  a given  function.  The 
functional  approach  does  not  Isolate  the  different  systems,  spaces,  and 
personnel  which  all  provide  service  to  the  same  function.  This  kind  of 
a total  look  will  help  Identify  vulnerable  points  in  the  ship  design. 
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The  Vital  Function  Concept  in  the  Design  of  Naval  Ships 
Introduction 


Throughout  its  history  the  United  States  has  built  ships  to  fight 
battles  at  sea.  Naval  combatant  ships,  and  the  auxiliary  ships  and 
craft  which  support  them,  are  built  with  the  express  purpose  of  seeking 
out  the  enemy  at  sea  and  destroying  him.  Although  it  Is  hoped  that  the 
fighting  ships  will  never  see  the  heat  of  battle,  they  are  so  designed, 
built,  exercised  and  prepared. 

All  ships  including  naval  ships  are  designed  Co  withstand  Che 
normal  perils  of  Che  sea:  wind,  waves  and  weather,  and  Co  withstand,  to 
some  extent,  stranding,  collision  and  human  fallibility.  However,  only 
naval  ships  may  be  required  to  accept  these  hazards  in  time  of  conflict 
or  emergency  when  they  cannot  be  avoided  and  when  battle  damage  is 
imminent.  The  naval  ship  cannot  always  run  from  natural  perils;  she  is 
designed  to  continue  to  function  under  the  harshest  of  conditions. 

The  designers  of  naval  ships  have  always  worked  to  reduce  the 
vulnerability  of  their  design.  One  mission  of  the  ship,  to  seek  out  and 
destroy  the  enemy,  today  requires  many  complex  systems  which  must  be 
protected.  The  naval  ship  presents  a threat  only  if  these  systems  can 
continue  to  operate  in  Che  heat  of  battle.  Thus  naval  ships  are  designed 
to  take  punishment.  The  continued,  sustained  projection  of  sea  power 
depends  on  tough  ships  which  can  resist  the  elements;  which  can  protect 
the  men  who  fight  them;  which  can  accept  damage,  be  repaired  and  fight 
again;  and  which  can  resist  damage  due  to  shipboard  accidents.  This 
toughness  can  be  examined  by  looking  at  the  functions  performed  by  the 
ship . 

Definition  of  Vital  Functions 


The  ship's  systems  can  be  organized  by  function.  Functional  break- 
downs have  often  been  used  to  deal  with  the  ship's  complexity  for  various 
design  purposes,  and  can  also  be  used  to  deal  with  vulnerability.  The 
word  "functions"  rather  than  "systems"  or  "spaces"  Is  used  because  it  is 
a general  term.  Included  within  the  idea  of  "functions"  are  "systems" 
and  "spaces",  as  well  as  attributes  such  as  "visibility  from  the  pilot 
house",  or  "access  for  fire  fighting  purposes".  Both  visibility  and 
access  are  functions  which  can  not  really  be  termed  a "space"  or  "systems." 
Some  functions  may  be  considered  to  be  more  important  than  others  since 
they  are  directly  related  to  survival  of  the  ship,  ship  mobility  and  the 
ability  to  fight.  These  functions  which  are  essential  for  the  ship's 
mission  may  be  called  vital  functions. 
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vital  functions  are  those  which  are  necessary  for  the  continued 
operation  of  the  ship.  The  idea  of  vital  functions  has  appeared  in  the 
General  Specifications  for  Ships  of  the  United  States  Navy  as  part  of 
the  requirement  for  vital  spaces.  Five  vital  functions  are  listed,  they 
are : 


Ship  Control 
Propulsion 
Communications 
Seaworthiness 
Combat  Capability 


Vital  functions  are  highlighted  so  that  we  can  give  them  added 
viability.  A space  such  as  the  Combat  Information  Center  (CIC)  contains 
vital  equipment  and  houses  men  who  perform  vital  operations.  This  space 
should  be  protected  more  than  a storeroom  or  an  office.  A vital  func- 
tion such  as  fire  fighting  depends  on  the  fire  main  which  thus  should  be 
given  more  attention  than  the  fresh  water  system. 


I hope  in  this  paper  to  illustrate  how  the  idea  of  vital  functions 
applies  to  existing  ships  and  how  it  can  be  applied  to  new  ship  designs. 
In  existing  ships  it  is  a useful  way  to  organize  existing  protective 
measures  to  evaluate  their  effectiveness.  In  new  ship  designs,  the  Idea 
can  be  used  to  give  reduced  vulnerability.  From  the  idea  of  vital  func- 
tions we  can  identify  vital  systems,  spaces  and  attributes  which  can  be 
given  protection  once  they  have  been  so  identified.  A list  of  vital 
functions  is  proposed  and  a short  evaluation  sequence  is  given  which  can 
be  used  to  aid  in  providing  effective  protection. 


Most  studies  of  vulnerability  have  identified  methods  of  protection 
which  apply  in  general  to  all  kinds  of  systems.  These  are  described 
below,  followed  by  a discussion  of  how  they  apply  to  existing  ship 
designs.  These  basic  design  ideas  which  are  used  to  give  protection  to 
vital  functions  are: 


Redundancy 

Segregation 

Consolidation 

Protection 


These  ideas  are  often  combined,  as  when  redundant  parts  of  a system  are 
segregated.  One  of  these  measures,  protection,  can  be  given  by  mechanical 
means  such  as  armor,  the  others  depend  on  arrangement. 


Redundancy  - Redundancy  In  a design  is  achieved  by  Including  more  i 
than  one  means  to  accomplish  a function.  This  Includes  various  types  of  | i 
back  up  systems  as  well  as  duplicate  systems.  ^ 


Segregation  - This  term  covers  the  breaking  up  of  a system  Into 
parts;  as  well  as  separation,  providing  a protective  distance  between 
functions. 

Consolidation  - Most  systems  have  a number  of  parts  In  series.  If 
any  one  of  the  parts  In  series  Is  destroyed,  the  system  cannot  function. 
To  achieve  reduced  vulnerability,  since  none  of  the  parts  Is  useful 
without  the  others,  they  are  located  close  to  one  another.  This  way 
they  present  a small  target  and  may  be  more  effectively  segregated  from 
redundant  systems. 


Protection  - ^rmor  and  shock  mounting  are  forms  of  protection,  a 
material  form  of  uefense  against  mechanical  damage. 

Protection  of  Vital  Functions 

The  Navy's  current  design  practice  Includes  all  four  of  these 
Ideas  In  many  different  forms.  Also,  many  features  of  ship  design,  not 
primarily  Intended  to  reduce  vulnerability,  do  so.  Forward  and  after 
gun  mounts  may  be  included  to  provide  360°  coverage  but  they  also  are 
redundant.  Valves  In  some  systems  may  be  Intended  to  simplify  repairs, 
but  they  also  make  It  possible  to  segregate  damaged  parts  of  the  system. 
An  expanded  list  of  vital  functions  Is  Included  below  so  that  current 
design  practices  which  protect  vital  functions  can  be  discussed: 


Seaworthiness 
Ship  Control 
Propulsion 
Manpower 

Structural  Integrity 
Damage  Control 
Access 

Combat  Capability 
Sensors  (Radar,  Sonar) 

Conmunlcatlon 
Power  & Lighting 
Ventilation 

Enclosure  of  vital  spaces 
Chilled  Water 

Seaworthiness  - One  aspect  of  seaworthiness  Is  the  ability  to 
remain  afloat.  Ships  are  segregated  Into  watertight  compartments  to 
limit  flooding;  In  addition,  they  may  be  protected  by  armor  belts  or 
other  passive  protective  systems. 
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Ship  Control  - Steering  may  be  controlled  from  the  bridge  or  from 
after  steering  and  many  ships  have  a Secondary  Conning  Station.  Larger 
ships  have  two  or  more  rudders.  In  the  steering  gear  room,  there  are 
generally  two  hydraulic  pumps  and  control  mechanisms  which  may  receive 
signals  from  either  of  two  ship  control  cables.  This  is  backed  up  by  a 
hand  pump  and,  if  the  hand  pump  falls,  chain  falls  can  be  used  to  move 
the  rudder.  The  hydraulic  pumps  have  several  back  up  means  of  receiving 
electrical  power.  Usually  more  than  one  radar  system  Is  installed  for 
ship  control.  Several  repeaters  are  included.  CIC  generally  contains 
more  than  one  analog  plotting  board  which  can  be  used  for  maneuvering. 

The  visual  conning  by  the  Officer  of  the  Deck  (OOD)  on  the  bridge  backs 
up  the  plot  in  CIC  and  vice  versa. 

Some  amount  of  segregation  in  ship  control  is  achieved  by  locating 
CIC  away  from  the  bridge.  The  steering  control  cables  are  run  on  opposite 
sides  of  the  ship. 

Propulsion  - The  propulsion  function  is  made  redundant  by  incorporating 
multiple  propellers,  or  if  a single  shaft  is  used,  by  providing  auxiliary 
propulsion  units. 

The  propulsion  machinery  for  each  propeller  is  usually  consolidated 
in  a separate  space  and  may  be  protected  by  armor  or  a side  protection 
system. 

Manpower  - Current  training  systems  are  designed  to  provide  some 
redundancy  by  cross-rate  training.  This  type  of  training,  for  example, 
gives  the  machinist  mate  some  idea  of  how  the  electrician's  job  relates 
to  his.  Usually,  more  than  one  person  is  qualified  for  a given  job. 

Further  redundancy,  segregation  and  consolidation  of  manpower  accompanies 
redundancy,  segregation  and  consolidation  of  the  systems  which  are 
served. 

Methods  of  protection  may  include  protective  clothing.  Oxygen 
Breathing  Apparatus  (OBA's),  airline  masks,  means  of  escape,  emergency 
lighting  systems  and  the  air  tightness,  water  tightness,  and  ballistic 
protection  afforded  by  ships'  structure. 

Structural  Integrity  - Design  factors  are  a form  of  redundant 
design.  The  need  to  protect  aluminum  structures  from  high  temperatures 
is  becoming  increasingly  a part  of  design  practice. 

Damage  Control  - There  are  many  redundant  features  in  damage  control. 
The  many  pumps  supplying  the  fire  main,  its  port  and  starboard  segments 
and  the  many  fire  plugs  are  all  redundant  features.  There  are  several 
repair  stations  which  can  back  each  other  up.  Halon  systems  have  reserve 
bottles  for  a second  shot  capability.  Hangar  deck  sprinkling  systems 
are  supplied  from  multiple  locations  of  the  fire  main. 
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Segregation  is  accomplished  by  damage  control  valves 
iind  AFFF  stations  are  separated. 


Protection  for  a single  segment  fire  main  is  provided  by  locating 
it  near  the  centerline. 


Access  - In  many  manned  spaces  redundant  egress  Is  possible  through 
escape  scuttles.  The  escape  is  separated  as  much  as  possible  from  the 
main  access.  Accesses  to  vital  spaces  are  protected  by  making  them 
watertight  to  the  flooding  water  levels  and  by  insulating  the  escape 
trunks  from  main  machinery  spaces. 


Combat  Capability 


Multiple  weapons  systems  provide  redundancy 
Many  systems  can  be  controlled  from  several  locations.  The  weapons 
systems  may  be  separated  by  their  location  on  the  ship. 


Sensors  - Sensors  may  be  made  redundant,  for  example,  by  including 
designated  radar  systems  which  have  overlapping  capability.  Sensors  are 
separated  by  their  location  on  the  ship  ;ind  their  associated  equipment 
is  protected  by  vital  space  provisions. 


Communications  - Redundancy  varies  but  there  are  a number  of  systems 
which  have  overlapping  capability  including  the  MC  system.s,  dial  telephone, 
and  many  sound  powered  phone  systems.  The  MC  systems  and  sound  powered 
phone  systems  are  separated  into  various  circuits.  The  sound  powered 
phones  operate  through  several  switch  boards.  Ship  to  ship  communications 
may  be  through  a number  of  different  radio  transmitters,  flashing  light, 
signal  flag,  semaphone  or  megaphone.  All  communication  wiring  is  protected 
by  the  ship's  structure. 


Power  and  Lighting  - Vital  services  can  have  up  to  three  sources  of 
power:  normal,  alternate  or  emergency,  and  casualty  power.  Some  systems 
have  batteries  as  a back  up  power  source.  There  are  several  ship's 
service  generators  and  emergency  generators.  Normal  lighting  is  backed 
up  by  emergency  lighting  and  battery  powered  battle  lanterns. 


The  electrical  system  can  be  segregated  by  opening  bus  tie  breakers 
to  isolate  damaged  portions.  The  generators  are  separated  by  their 
location  on  the  ship.  Normally  the  main  power  cables  are  run  in  a loop 
and  are  separated  horizontally  iind  vertically.  The  cables  are  run  to 
take  advantage  of  existing  structural  protection  and  to  avoid  hazardous 
areas. 


Ventilation  - Natural  ventilation  provides  some  redimdancy  for 
forced  ventilation.  Recirculating  air  conditioning  for  some  vital 
spaces  is  provided  by  multiple  sets  of  cooling  coils.  Consolidation  in 
recirculating  air  conditioning  has  occasionally  been  provided  by  locating 
a designated  unit  within  or  adjacent  to  the  vital  space  it  served. 


Enclosures  of  Vital  Spaces  - Vital  spaces  may  be  separated  by 
airtight  or  watertight  bulkheads  or  by  distance  within  the  ship. 

Vital  space  bulkheads  are  airtight  or  watertight  and  aluminum 
bulkheads  may  be  protected  by  insulation  to  resist  the  entry  of  heat, 
smoke  and  flame. 

Vital  Functions  Design  Approach 

How  can  we  improve  the  protection  of  vital  functions?  Most  of 
current  methods  which  are  a part  of  design  practice  have  developed  in 
response  to  a need  or  are  the  result  of  good  engineering  judgment. 
Recently,  systematic  approaches  have  become  popular  and  have  been 
applied  to  the  vulnerability  problem.  However,  accidents  continue  to 
cause  costly  damage  to  ships.  The  accident  damage  is  almost  the  only 
evidence  we  have  of  the  capacity  of  ships  to  withstand  damage  since  few 
modem  United  States  capital  ships  have  sustained  battle  damage.  Ships 
of  foreign  navies  have  been  involved  in  isolated  incidents  but  have  not 
been  examined  by  United  States  designers.  Accidents  repeatedly  prove  to 
us  that  ships  need  improved  protection.  Protection  is  expensive,  redun- 
dant systems,  added  armor  and  thermal  insulation  add  to  the  topside 
weight  and  to  the  cost,  which  is  already  excessive.  Systematic  methods 
to  define  the  need  for  protection  by  matching  a threat  to  a level  of 
need  for  each  vital  function,  can  be  devised  to  provide  the  most  effi- 
cient protection  for  a given  cost. 

A systematic  approach  would  first  rank  the  vital  functions  in  order 
of  importance  to  the  survival  of  the  ship.  For  example,  a ranking  might 
be: 


1.  Functions  which  keep  the  ship  afloat. 

2.  Functions  which  propel  and  maneuver  the  ship. 

3.  Functions  which  enable  the  ship  to  perform  its  mission. 

Next,  the  threats  to  each  function  would  be  ranked  in  the  order  of  which 
would  cause  the  most  damage.  Threats  might  include  the  possibility  of 
flooding,  fire  damage,  ruptured  piping  destroying  electronics  equipment 
or  explosions  in  nearby  magazines.  The  threats  would  be  balanced  against 
the  importance  of  the  function  to  establish  protection  priorities.  The 
combination  of  function  and  threat  which  receives  the  highest  rating  of 
combined  threat  and  importance  would  receive  the  greatest  protection 
from  that  threat. 

At  this  point  the  designer  would  consider  what  sort  of  protection 
to  apply.  Various  criteria  could  be  used  to  decide  which  protective 
measure  is  most  efficient.  Depending  on  the  ship  type  or  the  economic 
environment,  least  weight,  least  cost,  least  rise  in  center  of  gravity 
(KG)  or  some  other  criterion  or  combination  of  criteria  could  be  used. 
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This  kind  of  a comvi rehens ive  approach  has  some  disadvantages.  It 
becomes  a long  and  tedious  process  which  can  best  be  performed  by  the 
computer.  The  actual  damage  done  by  fire  or  explosion  is  difficult  to 
predict  as  is  the  effectiveness  of  the  protective  measures.  Invariably 
assumptions  have  to  be  made  which  will  affect  the  outcome  of  the  process. 
There  is  also  the  problem  of  precision;  e.g.,  trying  to  rate  the  degree 
of  vulnerability  of  a system  on  a scale  from  1-5  when  it  is  more  realis- 
tically rated  on  a scale  of  1-2.  Finally,  the  results  of  such  an  iinalysls 
are  difficult  to  test.  In  fac^  such  testing  would  probably  require  the 
destruction  of  seveial  ships. 

At  the  present  time  the  Navy  does  use  a system  of  computer  programs 
wtilch  can  estimate  the  effects  of  ballistic  damage  on  the  functional 
operation  of  the  ship,  and  is  developing  a model  for  fire  spread  damage. 
Thus  the  Navy  relies  on  the  combined  computer  outputs,  experienced 
engineers  ;md  established  design  practices  for  ship  protection.  When  an 
engineer  is  developing  his  design  for  a new  ship  system,  he  should  from 
time  to  time  review  It  and  decide  whether  it  is  insufficiently  or 
excessively  protected.  He  should  break  down  his  system  so  that  it 
becomes  apparent  what  parts  are  vulnerable  and  what  methods  he  can  use 
to  add  protection.  The  following  questions  can  aid  in  this  kind  of 
analysis : 

I.  Is  this  system  necessary  for  the  performance  of  a vital  function? 


II.  How  much  segregation  is  needed? 

a.  Can  the  vital  parts  be  segregated  from  the  non-vital 
parts? 

b.  Can  damaged  parts  be  segregated  from  undamaged  parts? 

III.  How  much  redundancy  is  needed? 

a.  Are  the  redundant  parts  separated?  Protected? 

b.  Are  the  series  parts  consolidated?  Protected? 

IV.  Separation  from  other  vital  functions. 

a.  Is  this  vital  system  separated  from  other  vital  systems 
which  function  independently?  Is  there  separation  of 
vital  functions  within  the  system? 

V.  Does  this  system  endanger  other  systems?  How  can  this  danger 
be  avoided  or  reduced? 

The  engineer's  judgment  and  ingenuity  are  needed  to  decide  whether  the 
protective  features  Implied  by  the  questions  are  desirable  and,  if  so, 
how  to  apply  them.  This  kind  of  an  overall  look  is  less  tedious  and  can 
be  nearly  as  effective  as  full  scale  computerized  study. 


An  analysis  of  the  chilled  water  system  can  be  used  to  illustrate 
the  use  of  this  method.  The  chilled  water  system  provides  cooling  water 
to  control  the  temperature  of  electronic  equipment  and  to  cool  air 
conditioning  coils.  Several  chilled  water  plants  cool  fresh  water  which 
is  pumped  to  the  user  of  chilled  water  and  recirculated  back  to  the 
plant.  There  is  a chilled  water  main  made  up  of  a supply  and  a return 
pipe  which  forms  a loop  within  the  ship. 

Now  run  through  the  analysis: 

I.  The  system  is  vital  because  it  cools  vital  pieces  of  electronic 
equipment.  These  electronics  can  operate  only  for  a short  time  without 
chilled  water. 

II.  Segregation  is  accomplished  by  cut-out  valves. 

a.  Vital  parts  can  be  segregated  because  risers  from  the 
main  serving  vital  equipment  are  separate  from  those 
carrying  non-vital  functions.  All  risers  have  root 
valves . 

b.  There  are  segregation  valves  around  the  loop. 

III.  The  system  is  redundant;  each  vital  cooling  coil  is  supplied 
from  two  segments  of  the  main  loop.  Each  segment  can  be  connected  to 
any  or  all  of  the  chilled  water  plants. 

a.  The  chilled  water  plants  are  located  in  separate  spaces 
throughout  the  ship.  They  are  generally  protected  by 
ship's  structure. 

b.  All  of  the  equipment  required  to  cool  the  water  is  located 
in  a single  space. 

IV.  Separation  from  the  other  vital  functions. 

a.  The  chilled  water  plants  are  usually  located  in  spaces 
with  other  equipment.  Risers  to  vital  services  are 
distributed  evenly  to  each  segment. 

V.  Damaged  piping  could  cause  water  damage. 

The  analysis  shows  that  there  is  redundancy,  segregation,  consolidation 
and  some  protection.  The  designer's  question  is:  Is  this  too  much  or 
too  little?  It  also  shows  that  some  thought  should  be  given  to  locating 
chilled  water  plants  in  separate  spaces  and  to  locating  chilled  water 
piping  to  minimize  damage  to  equipment  in  the  event  of  rupture. 
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Summary 


Naval  ships  are  unique  because  they  are  expected  to  sustain  damage 
in  the  course  of  performing  their  mission.  They  must  continue  to  operate 
in  .ipite  of  damage.  Certain  functions  may  be  identified  which  enable 
the  ship  to  continue  operating,  they  may  be  called  vital  functions. 
Vulnerability  experts  have  classified  redundancy,  segregation,  consolidation 
and  protection  as  the  means  of  providing  protection.  Once  the  vital 
functions  have  been  identified,  these  protective  measures  are  used  to 
ensure  that  they  will  continue  to  support  the  ship's  operation.  Every 
engineer  can  use  the  list  given  here  and  the  short  evaluation  procedure 
to  provide  added  protection  in  his  design  area. 
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